HTTP: Microsoft Secondary Logon CVE-2016-0099 Privilege Escalation

This signature detects attempts to exploit a known vulnerability against Microsoft Windows. A successful attack can lead to arbitrary code execution.

Extended Description

The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 does not properly process request handles, which allows local users to gain privileges via a crafted application, aka "Secondary Logon Elevation of Privilege Vulnerability."

Affected Products

Microsoft windows_10_1511

References

CVE: CVE-2016-0099

Short Name

HTTP:STC:DL:MS-SECLOGON-PRIV

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Microsoft Secondary Logon CVE-2016-0099 Privilege Escalation

Extended Description

Affected Products

References

Found a potential security threat?